arize-phoenix 11.23.1__py3-none-any.whl → 12.28.1__py3-none-any.whl

phoenix/server/api/routers/v1/users.py

@@ -12,15 +12,6 @@ from sqlalchemy.exc import IntegrityError as PostgreSQLIntegrityError
 from sqlalchemy.orm import joinedload
 from sqlean.dbapi2 import IntegrityError as SQLiteIntegrityError  # type: ignore[import-untyped]
 from starlette.datastructures import Secret
-from starlette.status import (
-    HTTP_201_CREATED,
-    HTTP_204_NO_CONTENT,
-    HTTP_400_BAD_REQUEST,
-    HTTP_403_FORBIDDEN,
-    HTTP_404_NOT_FOUND,
-    HTTP_409_CONFLICT,
-    HTTP_422_UNPROCESSABLE_ENTITY,
-)
 from strawberry.relay import GlobalID
 from typing_extensions import TypeAlias, assert_never
 
@@ -45,6 +36,7 @@ from phoenix.server.api.routers.v1.utils import (
 )
 from phoenix.server.api.types.node import from_global_id_with_expected_type
 from phoenix.server.authorization import is_not_locked, require_admin
+from phoenix.server.ldap import is_ldap_user, is_null_email_marker
 
 logger = logging.getLogger(__name__)
 
@@ -68,6 +60,10 @@ class OAuth2UserData(UserData):
     oauth2_user_id: str = UNDEFINED
 
 
+class LDAPUserData(UserData):
+    auth_method: Literal["LDAP"]
+
+
 class DbUser(V1RoutesBaseModel):
     id: str
     created_at: datetime
@@ -82,7 +78,13 @@ class OAuth2User(OAuth2UserData, DbUser):
     profile_picture_url: str = UNDEFINED
 
 
-User: TypeAlias = Annotated[Union[LocalUser, OAuth2User], Field(..., discriminator="auth_method")]
+class LDAPUser(LDAPUserData, DbUser):
+    pass
+
+
+User: TypeAlias = Annotated[
+    Union[LocalUser, OAuth2User, LDAPUser], Field(..., discriminator="auth_method")
+]
 
 
 class GetUsersResponseBody(PaginatedResponseBody[User]):
@@ -94,7 +96,9 @@ class GetUserResponseBody(ResponseBody[User]):
 
 
 class CreateUserRequestBody(V1RoutesBaseModel):
-    user: Annotated[Union[LocalUserData, OAuth2UserData], Field(..., discriminator="auth_method")]
+    user: Annotated[
+        Union[LocalUserData, OAuth2UserData, LDAPUserData], Field(..., discriminator="auth_method")
+    ]
     send_welcome_email: bool = True
 
 
@@ -113,7 +117,7 @@ DEFAULT_PAGINATION_PAGE_LIMIT = 100
     response_description="A list of users.",
     responses=add_errors_to_responses(
         [
-            HTTP_422_UNPROCESSABLE_ENTITY,
+            422,
         ],
     ),
     dependencies=[Depends(require_admin)],
@@ -161,6 +165,19 @@ async def list_users(
                     password_needs_reset=user.reset_password,
                 )
             )
+        elif isinstance(user, models.OAuth2User) and is_ldap_user(user.oauth2_client_id):
+            # Check if this is an LDAP user (identified by special marker)
+            data.append(
+                LDAPUser(
+                    id=str(GlobalID("User", str(user.id))),
+                    username=user.username,
+                    email="" if is_null_email_marker(user.email) else user.email,
+                    role=user.role.name,
+                    created_at=user.created_at,
+                    updated_at=user.updated_at,
+                    auth_method="LDAP",
+                )
+            )
         elif isinstance(user, models.OAuth2User):
             oauth2_user = OAuth2User(
                 id=str(GlobalID("User", str(user.id))),
@@ -187,12 +204,12 @@ async def list_users(
     summary="Create a new user",
     description="Create a new user with the specified configuration.",
     response_description="The newly created user.",
-    status_code=HTTP_201_CREATED,
+    status_code=201,
     responses=add_errors_to_responses(
         [
-            {"status_code": HTTP_400_BAD_REQUEST, "description": "Role not found."},
-            {"status_code": HTTP_409_CONFLICT, "description": "Username or email already exists."},
-            HTTP_422_UNPROCESSABLE_ENTITY,
+            {"status_code": 400, "description": "Role not found."},
+            {"status_code": 409, "description": "Username or email already exists."},
+            422,
         ]
     ),
     dependencies=[Depends(require_admin), Depends(is_not_locked)],
@@ -213,10 +230,18 @@ async def create_user(
     # Prevent creation of SYSTEM users
     if role == "SYSTEM":
         raise HTTPException(
-            status_code=HTTP_400_BAD_REQUEST,
+            status_code=400,
             detail="Cannot create users with SYSTEM role",
         )
 
+    # Prevent OAuth2 users from using the LDAP marker or any variation
+    if isinstance(user_data, OAuth2UserData):
+        if is_ldap_user(user_data.oauth2_client_id):
+            raise HTTPException(
+                status_code=400,
+                detail="Cannot create OAuth2 users with reserved LDAP identifier",
+            )
+
     user: models.User
     if isinstance(user_data, LocalUserData):
         password = (user_data.password or secrets.token_hex()).strip()
@@ -241,6 +266,11 @@ async def create_user(
             oauth2_client_id=user_data.oauth2_client_id or None,
             oauth2_user_id=user_data.oauth2_user_id or None,
         )
+    elif isinstance(user_data, LDAPUserData):
+        user = models.LDAPUser(
+            email=email,
+            username=username,
+        )
     else:
         assert_never(user_data)
     try:
@@ -252,12 +282,12 @@ async def create_user(
             session.add(user)
     except (PostgreSQLIntegrityError, SQLiteIntegrityError) as e:
         if "users.username" in str(e):
-            raise HTTPException(status_code=HTTP_409_CONFLICT, detail="Username already exists")
+            raise HTTPException(status_code=409, detail="Username already exists")
         elif "users.email" in str(e):
-            raise HTTPException(status_code=HTTP_409_CONFLICT, detail="Email already exists")
+            raise HTTPException(status_code=409, detail="Email already exists")
         else:
             raise HTTPException(
-                status_code=HTTP_409_CONFLICT,
+                status_code=409,
                 detail="Failed to create user due to a conflict with existing data",
             )
     id_ = str(GlobalID("User", str(user.id)))
@@ -289,6 +319,16 @@ async def create_user(
             data.oauth2_user_id = user.oauth2_user_id
         if user.profile_picture_url:
             data.profile_picture_url = user.profile_picture_url
+    elif isinstance(user_data, LDAPUserData):
+        data = LDAPUser(
+            id=id_,
+            email=email,
+            username=username,
+            auth_method="LDAP",
+            role=user_data.role,
+            created_at=user.created_at,
+            updated_at=user.updated_at,
+        )
     else:
         assert_never(user_data)
     # Send welcome email if requested
@@ -307,13 +347,13 @@ async def create_user(
     summary="Delete a user by ID",
     description="Delete an existing user by their unique GlobalID.",
     response_description="No content returned on successful deletion.",
-    status_code=HTTP_204_NO_CONTENT,
+    status_code=204,
     responses=add_errors_to_responses(
         [
-            {"status_code": HTTP_404_NOT_FOUND, "description": "User not found."},
-            HTTP_422_UNPROCESSABLE_ENTITY,
+            {"status_code": 404, "description": "User not found."},
+            422,
             {
-                "status_code": HTTP_403_FORBIDDEN,
+                "status_code": 403,
                 "description": "Cannot delete the default admin or system user",
             },
         ]

phoenix/server/api/routers/v1/utils.py

@@ -3,10 +3,6 @@ from typing import Any, Generic, Optional, TypedDict, TypeVar, Union
 from fastapi import HTTPException
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from starlette.status import (
-    HTTP_404_NOT_FOUND,
-    HTTP_422_UNPROCESSABLE_ENTITY,
-)
 from strawberry.relay import GlobalID
 from typing_extensions import TypeAlias, assert_never
 
@@ -135,21 +131,21 @@ async def _get_project_by_identifier(
             name = project_identifier
         except HTTPException:
             raise HTTPException(
-                status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+                status_code=422,
                 detail=f"Invalid project identifier format: {project_identifier}",
             )
         stmt = select(models.Project).filter_by(name=name)
         project = await session.scalar(stmt)
         if project is None:
             raise HTTPException(
-                status_code=HTTP_404_NOT_FOUND,
+                status_code=404,
                 detail=f"Project with name {name} not found",
             )
     else:
         project = await session.get(models.Project, id_)
         if project is None:
             raise HTTPException(
-                status_code=HTTP_404_NOT_FOUND,
+                status_code=404,
                 detail=f"Project with ID {project_identifier} not found",
             )
     return project